Security Access Control Policy Research Articles

Systematic Literature Review on Security Access Control Policies and Techniques Based on Privacy Requirements in a BYOD Environment: State of the Art and Future Directions

The number of devices connected within organisational networks through ”Bring Your Own Device” (BYOD) initiatives has steadily increased. BYOD security risks have resulted in significant privacy and security issues impacting organisational security. Many researchers have reviewed security and privacy issues in BYOD policies. However, not all of them have fully investigated security and privacy requirements. In addition to describing a system’s capabilities and functions, these requirements also reflect the system’s ability to eliminate various threats. This paper aims to conduct a comprehensive review of privacy and security criteria in BYOD security policies, as well as the various technical policy methods used to mitigate these threats, to identify future research opportunities. This study reviews existing research and highlights the following points: (1) classification of privacy and security requirements in the context of BYOD policies; (2) comprehensive analyses of proposed state-of-the-art security policy technologies based on three layers of security BYOD policies, followed by analyses of these technologies in terms of the privacy requirements they satisfy; (3) technological trends; (4) measures employed to assess the efficacy of techniques to enhance privacy and security; and (5) future research in the area of BYOD security and privacy.

Multi-level Protection (Mlp) Policy Implementation using Graph Database

By defining and testing the Bell-LaPadula access control environment within it, this paper implements a Multi-Level Protection (MLP) lattice model architecture based on a graph database. By leveraging Bell-LaPadula security concepts and the MLP lattice model, the graph database (Neo4j) is used as a method for enforcing MLP policy. A formal structure in which Bell-LaPadula protection concepts are applied to track the information flow within a single domain after checking that the MLP lattice model is correctly represented in the graph database. Finally, we expand and improve the formal structure so that for the MLP multi-domain context, an MLP security access control policy can be defined. With the new enhanced model, we can conduct a query to verify if the subject in one domain can access the object in another domain, while a trust relationship connects the two domains.

Security assurance of MongoDB in singularity LXCs: an elastic and convenient testbed using Linux containers to explore vulnerabilities

It is essential to ensure the data security of data analytical frameworks as any security vulnerability existing in the system can lead to a data loss or data breach. This vulnerability may occur due to attacks from live attackers as well as automated bots. However inside attacks are also becoming more frequent because of incorrectly implemented security requirements and access control policies. Thus, it is important to understand security goals and formulate security requirements and access control policies accordingly. Therefore, it is equally important to identify the existing security vulnerabilities of a given software system. To find the available vulnerabilities against any system, it is mandatory to conduct vulnerability assessments as scheduled tasks in a regular manner. Thus, an easily deployable, easily maintainable, accurate vulnerability assessment testbed or a model is helpful as facilitated by Linux containers. Nowadays Linux containers (LXCs) which have operating system level virtualization, are very popular over virtual machines (VMs) which have hypervisor or kernel level virtualization in high performance computing (HPC) due to reasons, such as high portability, high performance, efficiency and high security (Chae et al in Clust Comput 22:1765-1775, 2019. https://doi.org/10.1007/s10586-017-1511-2 ). Hence, LXCs can make an efficient and scalable vulnerability assessment testbed or a model by using already developed analyzing tools such as OpenVas, Dagda, PortSpider, MongoAudit, NMap, Metasploit Framework, Nessus, OWASP Zed Attack Proxy, and OpenSCAP, to assure the required security level of a given system very easily. To verify the overall security of any given software system, this paper first introduces a virtual, portable and easily deployable vulnerability assessment general testbed within the Linux container network. Next, the paper presents, how to conduct experiments using this testbed on a MongoDB database implemented in Singularity Linux containers to find the available vulnerabilities in 1. MongoDB application itself, 2. Images accompanied by containers, 3. Host, and 4. Network by integrating seven tools: OpenVas, Dagda, PortSpider, MongoAudit, NMap, Metasploit Framework, and Nessus to the container-based testbed. Finally, it discusses how to use generated results to improve the security level of the given system.

Scalable and secure access control policy for healthcare system using blockchain and enhanced Bell–LaPadula model

Access control is a policy in data security that controls access to resources. The current access control mechanisms are facing many problems, due to the interference of the third-party, privacy, and security of data. These problems can be addressed by blockchain, the technology that gained major attention in recent years and has many capabilities. However, in the blockchain network, every peer maintains the same state of the ledger to view the complete history of transactions that leads to scalability issues in the blockchain network. To address the problem of scalability we propose an enhanced Bell–LaPadula model and categorized the peers and transactions in different clearance and security levels. The peers don’t have to maintain the complete history of transactions owing to the clearance level. To provide data security in the network we constructed a dynamic access control policies using a smart contracts. We test our model on a blockchain-based healthcare network. The Hyperledger Fabric tool is used to run a complete infrastructure of healthcare organization while the Hyperledger composer modeling tool is used to implement the smart contracts and to provide dynamic access control functionality on the blockchain network.

Security access control policy of information system under multi-domain mode

The research of this article is ensuring the security implementation of multi-domain secure access control behaviour, through the study on unified description language for security policy, strategy conflict classification and strategy conflict detection. Based on current related technologies and combined with the feature of multi-domain system, the framework of access control strategy management is proposed, which specified the content of access control management. We adopt XACML that has better across-platform and scalability to describe the policy uniformly. Then access control policy description template based on XACML is provided and the security policy conflict is classified reasonably according to the factors causing conflict. Then we put forward a model to detect the inconsistency of RBAC and RH in time and space constraint, to design an access control model which needs pruning and collection. It uses logic analysis to strength the conflict detection for developing security policy integration. The simulation shows our work can provide filter on quantities of irrelevant policy and return potential policies to solute the conflict.

Security access control policy of information system under multi-domain mode

Security access control policy of information system under multi-domain mode

Scalable and secure access control policy update for outsourced big data

Ciphertext Policy Attribute-based Encryption (CP-ABE) is proven to be one of the most effective approaches to data access control in data outsourcing environment such as cloud computing since it provides efficient key management based on user attributes of multiple users in accessing shared data. However, dealing with policy update limits the efficiency of the CP-ABE. In CP-ABE scheme, the access policy is used as a core element for data encryption. Hence, if the policy is updated, the data owner needs to re-encrypt files and send them back to the cloud. This incurs overheads including computation, communication, and maintenance cost at the data owner side. The computation and communication cost are very expensive if the outsourcing environment is devoted to “big data”. In this paper, we extend the capability of our access control scheme: C-CP-ARBE to be capable of supporting secure and flexible policy updates in the big data outsourcing environment. We develop a secure policy updating algorithm and propose a very lightweight proxy re-encryption (VL-PRE) technique to enable the policy updating to be done in the cloud in an efficient and computationally cost effective manner. Finally, we demonstrate the efficiency and performance of our proposed scheme through the implementation.

The logic of XACML

We study the international standard XACML 3.0 for describing security access control policies in a compositional way. Our main contributions are (i) to derive a logic that precisely captures the intentions of the standard, (ii) to formally define a semantics for the XACML 3.0 component evaluation, and (iii) to define a semantics for the XACML 3.0 standard combining operators. To guard against modeling artefacts we provide an alternative lattice based way of characterizing the policy combining operators and we formally prove the equivalence of these approaches thereby increasing our faith in either one. We then discuss several ways of extending XACML: one direction is to extend XACML with new combining operators, and another direction is to incorporate the notion of conflict into XACML. We conclude by discussing the possibility of analysing XACML policies for gaps and conflicts.

Rewrite Based Specification of Access Control Policies

Data protection within information systems is one of the main concerns in computer systems security and different access control policies can be used to specify the access requests that should be granted or denied. These access control mechanisms should guarantee that information can be accessed only by authorized users and thus prevent all information leakage. We propose a methodology for specifying and implementing access control policies using the rewrite based framework Tom . This approach allows us to check that any reachable state obtained following a granted access in the implementation satisfies the policy specification. We show that when security levels are not totally ordered some information leakage can be detected.

An Organizational View of Pervasive Computing

In their research, the authors find that organizations increasingly collect sensitive electronic information. Currently, they do not have a unified way of defining or implementing privacy or security access control policies for such information. This makes it difficult for the organizations to put in place proper management and control of sensitive information or to verify that required or intended regulations for the use of information are met by the organization. Examinations of privacy policy implementations within organizations have not changed the picture much in the past 20 years. Although there has been considerable attention to the development and posting of privacy policies, these policies are generally vague and lack connections to technology that might implement them. Closing the gap between the high-level policies to which organizations strive to adhere and the low-level actions carried out within their IT systems is an important topic for research and development.

The Development of Access Control Policies for Information Technology Systems

The identification of the major information technology (IT) access control policies is required to direct “best practice” approaches within the IT security program of an organisation. In demonstrating the need for security access control policies in the IT security program, it highlights the significant shift away from centralised mainframes towards distributed networked computing environments. The study showed that the traditional and proven security control mechanisms used in the mainframe environments were not applicable to distributed systems, and as a result, a number of inherent risks were identified with the new technologies. Because of the critical nature of the information assets of organisations, then appropriate risk management strategies should be afforded through access control policies to the IT systems. The changing technology has rendered mainframe centralised security solutions as ineffective in providing controls on distributed network systems This investigation revealed that the need for policies for access control of an information system from corporate governance guidelines and risk management strategies were required to protect information assets of an organisation. The paper proposes a high level approach to implementing security policies through information security responsibilities, management accountability policy, and other baseline access control security policies individual and distributed systems.

Conflicts in policy-based distributed systems management

Modern distributed systems contain a large number of objects and must be capable of evolving, without shutting down the complete system, to cater for changing requirements. There is a need for distributed, automated management agents whose behavior also has to dynamically change to reflect the evolution of the system being managed. Policies are a means of specifying and influencing management behavior within a distributed system, without coding the behavior into the manager agents. Our approach is aimed at specifying implementable policies, although policies may be initially specified at the organizational level and then refined to implementable actions. We are concerned with two types of policies. Authorization policies specify what activities a manager is permitted or forbidden to do to a set of target objects and are similar to security access-control policies. Obligation policies specify what activities a manager must or must not do to a set of target objects and essentially define the duties of a manager. Conflicts can arise in the set of policies. Conflicts may also arise during the refinement process between the high level goals and the implementable policies. The system may have to cater for conflicts such as exceptions to normal authorization policies. The paper reviews policy conflicts, focusing on the problems of conflict detection and resolution. We discuss the various precedence relationships that can be established between policies in order to allow inconsistent policies to coexist within the system and present a conflict analysis tool which forms part of a role based management framework. Software development and medical environments are used as example scenarios.